Help a Noob out

["Gibson, Nathan J. (HSC)" <Nathan-Gibson () ouhsc edu>]

Not sure what I am missing here but I have "web-client" in my disabledsid.conf for pulled pork. And its processed last 
but for some reason this rule keeps getting turned back on.


WARN - 1:15587 is re-enabled by a check of the http.doc flowbit!


How does one go about "unsetting" a flowbit so pulled pork wont re-enable it.

GIBBY



------------------------------------------------------------------------------
Achieve unprecedented app performance and reliability
What every C/C++ and Fortran developer should know.
Learn how Intel has extended the reach of its next-generation tools
to help boost performance applications - inlcuding clusters.
http://p.sf.net/sfu/intel-dev2devmay

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users